unsloth-bin

maintainer SelfRef · 0 votes · scanned 2026-08-18 09:39:35.720982

MEDIUM

Why flagged The package installs a prebuilt binary from a GitHub release, which is unverifiable and could be swapped with malicious code; the binary is executed on first launch via an install script.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a GitHub release, which is unverifiable and could be swapped with malicious code; the binary is executed on first launch via an install script.

PKGBUILD

      1# Maintainer: SelfRef <arch@selfref.dev>
    
      2
    
      3_pkgbase=unsloth
    
      4pkgname="$_pkgbase-bin"
    
      5pkgver=0.1.800.beta
    
      6pkgrel=1
    
      7pkgdesc='Local UI to run and train LLMs and diffusion models'
    
      8arch=('x86_64')
    
      9url='https://github.com/unslothai/unsloth'
    
      10license=('Apache-2.0' 'AGPL-3.0-or-later')
    
      11depends=(
    
      12	'cairo'
    
      13	'curl'
    
      14	'dbus'
    
      15	'gcc-libs'
    
      16	'gdk-pixbuf2'
    
      17	'glib2'
    
      18	'glibc'
    
      19	'gtk3'
    
      20	'hicolor-icon-theme'
    
      21	'libsoup3'
    
      22	'webkit2gtk-4.1'
    
      23	'xdg-utils'
    
      24)
    
      25optdepends=(
    
      26	'libayatana-appindicator: system tray icon'
    
      27	'git: triton kernels training speedup and --local installs'
    
      28	'cmake: build llama.cpp from source instead of using the prebuilt engine'
    
      29	'gcc: build llama.cpp from source instead of using the prebuilt engine'
    
      30)
    
      31provides=("$_pkgbase")
    
      32conflicts=("$_pkgbase")
    
      33options=('!strip' '!debug')
    
      34install=setup.install
    
      35
    
      36_debver="${pkgver//./_}"
    
      37_debfile="Unsloth-Desktop-$_debver-Ubuntu.deb"
    
      38source=("$pkgname-$pkgver.deb::$url/releases/download/v${pkgver/.beta/-beta}/$_debfile")
    
      39noextract=("$pkgname-$pkgver.deb")
    
      40sha256sums=('a8b2224b4dc4e463ee5cdff7ac38f4a1178cab5138b77b3141aeb9f6237160a0')
    
      41
    
      42prepare() {
    
      43	bsdtar -xOf "$pkgname-$pkgver.deb" data.tar.gz | bsdtar -x
    
      44
    
      45	# Upstream ships an empty Categories key, which drops the entry into "Other".
    
      46	sed -i \
    
      47		-e 's|^Categories=$|Categories=Development;|' \
    
      48		-e '/^Categories=/a Keywords=LLM;AI;ML;fine-tuning;training;inference;unsloth;' \
    
      49		usr/share/applications/Unsloth.desktop
    
      50}
    
      51
    
      52package() {
    
      53	# Tauri resolves its resource dir as <exe>/../lib/Unsloth, so install.sh has to
    
      54	# stay at /usr/lib/Unsloth/install.sh — that script builds the per-user Python
    
      55	# environment (~/.unsloth/studio) on first launch.
    
      56	install -Dm755 usr/bin/unsloth-studio "$pkgdir/usr/bin/unsloth-studio"
    
      57	install -Dm755 usr/lib/Unsloth/install.sh "$pkgdir/usr/lib/Unsloth/install.sh"
    
      58
    
      59	install -Dm644 usr/share/applications/Unsloth.desktop \
    
      60		"$pkgdir/usr/share/applications/unsloth-studio.desktop"
    
      61
    
      62	local _size
    
      63	for _size in 32x32 128x128; do
    
      64		install -Dm644 "usr/share/icons/hicolor/$_size/apps/unsloth-studio.png" \
    
      65			"$pkgdir/usr/share/icons/hicolor/$_size/apps/unsloth-studio.png"
    
      66	done
    
      67}
    
      68

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 09:39:35	MEDIUM	2